linux-kernel - Re: [PATCH] x86/microcode/AMD: Document which patches are not released for late loading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 22 Apr 2023 00:33:54 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Borislav Petkov <bp@...en8.de>, X86 ML <x86@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH] x86/microcode/AMD: Document which patches are not
 released for late loading

On Sat, Apr 15 2023 at 16:28, Borislav Petkov wrote:
> From: "Borislav Petkov (AMD)" <bp@...en8.de>
>
> PeterZ wanted this spelled out explicitly. Add it to the documentation
> so that everyone's on the same page wrt to which microcode patches are
> not allowed to be late loaded.
>
> Suggested-by: Peter Zijlstra (Intel) <peterz@...radead.org>
> Signed-off-by: Borislav Petkov (AMD) <bp@...en8.de>
> ---
>  Documentation/x86/microcode.rst | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/Documentation/x86/microcode.rst b/Documentation/x86/microcode.rst
> index 15b52e2b181d..d5ef9184030c 100644
> --- a/Documentation/x86/microcode.rst
> +++ b/Documentation/x86/microcode.rst
> @@ -218,6 +218,10 @@ a fault happens, the whole core will see it either before the microcode
>  patch has been applied or after. In either case, T0 and T1 will have the
>  same microcode revision and nothing intermediate.
>  
> +In addition, microcode patches which modify software-visible features
> +like CPUID bits, MSRs, chicken bits, etc are not released for late
> +loading.

No. Why the heck is AMD any different from Intel vs. late loading?

It does not matter at all that the AMD microcode machinery does not have
the concurrency issues like the Intel one, which just need some extra
care.

The software visible feature change issue is exactly the same and the
problem of late loading is all about that and not about the concurrency.

So Intel got its act together and added a minimal version field into the
microcode header. AMD should do exactly the same and not assume that
late loading is safe by pretending that updates which modify software
visible features are not released.

That's just not true. AMD releases microcode updates with software
visible changes as does Intel, no?

How did all the hardware vulnerability updates, which changed CPUID,
MSRs and chicken bits, get distributed? By not releasing them?

This patch along with the other which claims that AMD is safe is just
wishful thinking material.

Boris, please remove them from the for 6.4 queue.

Thanks,

        tglx